trustwalet-co[.]pages[.]dev

PhishDestroy identifies trustwalet-co.pages.dev as a domain actively impersonating the Trust Wallet brand to deploy a cryptocurrency wallet-drainer kit, a technique designed to trick users into approving malicious transactions that siphon digital assets directly from their wallets. The domain leverages the legitimate Cloudflare Pages hosting platform to serve a convincing replica of the official Trust Wallet interface, complete with spoofed login and seed-phrase collection forms intended to harvest private keys and mnemonic phrases. At the time of analysis, no publicly documented drainer kit fingerprint or JavaScript payload hash has been released by major security vendors, indicating this may be a newly deployed or custom variant tailored to evade static detection rules. This domain was registered through Cloudflare, Inc., and resolves to a single IPv4 address, 188.114.97.3, which appears to be part of Cloudflare’s edge network rather than a dedicated server infrastructure typically seen in long-running phishing operations. VirusTotal currently flags the site with a detection score of 0 out of 95 engines as of the latest scan, suggesting that signature-based defenses have not yet caught up to this campaign. The SSL certificate is issued by Google Trust Services under the GTS CA 1C3 trust chain, a common choice among phishing actors seeking to avoid browser warnings. A review of public blocklists shows zero current listings for the domain, reinforcing the likelihood that this threat is still in its early propagation phase and has not yet been widely blocked by network defenses. The current status of trustwalet-co.pages.dev is marked as active and under active investigation by multiple threat intelligence teams. Immediate response actions include adding the domain and its resolving IP to DNS sinkholes, web proxy blocklists, and endpoint detection rules focused on Cloudflare Pages deployments serving wallet-related content. Users are strongly advised to verify any wallet-related domain using official channels only and to enable hardware wallet authentication or multisig where possible. While the immediate risk to most users remains low due to the absence of detections and blocklist coverage, the threat level could escalate rapidly as awareness spreads and drainer payloads are analyzed. Continuous monitoring and proactive threat hunting are recommended to prevent this campaign from gaining traction.